JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 216.26.238.41

216.26.238.41 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 16%: ?

16%

ISP	3xK Tech GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS200373
Domain Name	3xktech.cloud
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 216.26.238.41

Whois 216.26.238.41

IP Abuse Reports for 216.26.238.41:

This IP address has been reported a total of 30 times from 16 distinct sources. 216.26.238.41 was first reported on September 26th 2025, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TRoden	2026-06-04 18:56:05 (13 hours ago)	Geo Block Plugin: Escalation flag(s): rce_attempt	Hacking
🇫🇷 LRob.fr	2026-05-23 09:45:04 (1 week ago)	WordPress login brute-force detected by Fail2Ban in plesk-wordpress jail	Brute-Force Web App Attack
🇩🇪 Ad Ministrator	2026-04-23 22:05:03 (1 month ago)	RdpGuard detected brute-force attempt on RD-WEB	Brute-Force
🇱🇻 garmtech.com	2026-03-09 01:10:11 (2 months ago)	IM360 WAF: WordPress plugin/theme auto install block	Web App Attack
🇱🇻 garmtech.com	2026-02-28 20:01:57 (3 months ago)	IM360 WAF: Attempt to upload malware	Hacking
🇺🇸 mind5t0rm	2026-02-12 22:28:41 (3 months ago)	(WPLOGIN) WP Login Attack 216.26.238.41 (US/United States/-): 3 in the last 3600 secs; Ports: ; Dir ... show more (WPLOGIN) WP Login Attack 216.26.238.41 (US/United States/-): 3 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_TRIGGER; Logs: 216.26.238.41 - - [13/Feb/2026:05:28:25 +0700] "GET /wp-login.php HTTP/2.0" 200 2470 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15" 216.26.238.41 - - [13/Feb/2026:05:28:28 +0700] "GET /wp-login.php?wp_lang=en_US HTTP/2.0" 200 2470 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36" 216.26.238.41 - - [13/Feb/2026:05:28:32 +0700] "POST /wp-login.php?wp_lang=en_US HTTP/2.0" 200 2580 "https://zerowaterthailand.com/wp-login.php?wp_lang=en_US" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36" show less	Port Scan
🇨🇭 ALPHANET	2025-12-30 12:53:41 (5 months ago)	web exploits	Hacking Exploited Host Web App Attack
🇩🇪 Packets-Decreaser.NET	2025-12-29 14:01:06 (5 months ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 TPI-Abuse	2025-12-29 09:50:27 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.238.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 216.26.238.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 04:50:23.911774 2025] [security2:error] [pid 11006:tid 11006] [client 216.26.238.41:31113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "winbayfire.com"] [uri "/.svn/wc.db"] [unique_id "aVJO338hQzr5_yT3EBxFNQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 08:12:37 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.238.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 216.26.238.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 03:12:32.899114 2025] [security2:error] [pid 1901:tid 1901] [client 216.26.238.41:9503] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "register-yacht-cook-islands.com"] [uri "/.env"] [unique_id "aVI38JxDgI5egFUrPbk6sgAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-29 06:19:41 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 216.26.238.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 216.26.238.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 01:19:33.812437 2025] [security2:error] [pid 2790:tid 2790] [client 216.26.238.41:48797] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "htaautosales.com"] [uri "/.svn/wc.db"] [unique_id "aVIddb7XxZt24dmlb7gm8gAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 myagent.site	2025-12-29 04:10:12 (5 months ago)	Blocking for trying to access an exploit file: /.env	Hacking
🇺🇸 nowyouknow	2025-12-19 01:02:04 (5 months ago)	(From [email protected]) Upgrade drtomalin.com search engine rankings, improve your online expos ... show more (From [email protected]) Upgrade drtomalin.com search engine rankings, improve your online exposure and grow powerful backlinks! BonusBacklinks.com - we build daily backlinks and drive website visits to your page EVERY DAY: + Get 85% OFF + Quality daily backlinks + Organic website visits + Price only from $1 + Bonus discount codes: https://tiny.cc/bonusbacklinks-discount BonusBacklinks.com - daily backlinks and website clicks to skyrocket your site everyday show less	Phishing Web Spam
🇪🇸 masterguru	2025-12-16 17:25:09 (5 months ago)	Restricted File Access Attempt. Matched phrase "wp-config.php" at REQUEST_FILENAME. (930130-122)	Hacking Web App Attack
Anonymous	2025-11-16 22:36:05 (6 months ago)	Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.16 is noted in report tim ... show more Attempted brute force login to web vpn 1 time(s); last attempt for 2025.11.16 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 30 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.180.246.83

🇳🇱 192.42.116.99

🇮🇳 182.95.175.190

🇺🇸 162.216.150.230

🇺🇸 162.216.150.113

🇩🇪 151.243.11.245

🇷🇴 80.94.92.184

🇱🇹 45.227.254.170

🇬🇧 35.203.211.218

🇺🇸 23.251.43.111

🇮🇳 182.95.49.166

🇮🇳 182.95.48.154

🇷🇺 178.207.10.91

🇺🇸 162.216.150.40

🇺🇸 162.216.149.37

🇮🇩 103.15.226.202

🇳🇱 45.148.10.152

🇸🇬 43.133.61.254

🇮🇪 34.242.105.1

🇻🇳 27.79.44.206